CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in David Vongries Welcome Email Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcome Email Editor: from n/a through 5.0.6.
Explanation of Vulnerability in Simple Terms
Welcome Email Editor through version 5.0.6 lacks proper authorization checks, allowing authenticated users with low privileges to modify email content they should not have access to. The vulnerability requires a valid user account but no special interaction. Site administrators should update to a version newer than 5.0.6 to prevent unauthorized email template changes.
What an attacker can do
Modify email templates and content without proper authorization.
Potential impact on your site
Unauthorized users can alter welcome emails and other email templates sent to your site visitors.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
